felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor(profiles): use @{bin} and @{lib} in profiles (3)

Browse source
This commit is contained in:
Alexandre Pujol 2023-07-09 14:09:55 +01:00
parent 2eed3b725f
commit 27daa7c9bb
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
355 changed files with 1473 additions and 1472 deletions
Download patch file Download diff file Expand all files Collapse all files

34
apparmor.d/groups/network/openvpn
View file

@ -22,7 +22,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/openvpn
@{exec_path} = @{bin}/openvpn
profile openvpn @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/nameservice-strict>
@ -50,7 +50,7 @@ profile openvpn @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr,
@{libexec}/{,NetworkManager/}nm-openvpn-service-openvpn-helper rPx,
@{lib}/{,NetworkManager/}nm-openvpn-service-openvpn-helper rPx,
/etc/openvpn/{,**} r,
@ -62,9 +62,9 @@ profile openvpn @{exec_path} flags=(attach_disconnected) {
@{run}/openvpn/*.{pid,status} rw,
@{run}/systemd/journal/dev-log rw,
/{usr/,}{s,}bin/ip rix,
/{usr/,}bin/systemd-ask-password rPx,
/{usr/,}lib/nm-openvpn-service-openvpn-helper rPx,
@{bin}/ip rix,
@{bin}/systemd-ask-password rPx,
@{lib}/nm-openvpn-service-openvpn-helper rPx,
/etc/openvpn/force-user-traffic-via-vpn.sh rCx -> force-user-traffic-via-vpn,
/etc/openvpn/update-resolv-conf{,.sh} rCx -> update-resolv,
@ -82,11 +82,11 @@ profile openvpn @{exec_path} flags=(attach_disconnected) {
/etc/openvpn/update-resolv-conf.sh r,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/cut rix,
/{usr/,}bin/which{,.debianutils} rix,
/{usr/,}bin/ip rix,
/{usr/,}{s,}bin/xtables-nft-multi rix,
@{bin}/{,ba,da}sh rix,
@{bin}/cut rix,
@{bin}/ip rix,
@{bin}/which{,.debianutils} rix,
@{bin}/xtables-nft-multi rix,
/etc/iproute2/rt_tables r,
/etc/iproute2/rt_tables.d/ r,
@ -106,13 +106,13 @@ profile openvpn @{exec_path} flags=(attach_disconnected) {
/etc/openvpn/ r,
/etc/openvpn/force-user-traffic-via-vpn.sh r,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/sed rix,
/{usr/,}bin/cut rix,
/{usr/,}bin/{,e}grep rix,
/{usr/,}bin/ip rix,
/{usr/,}{s,}bin/nft rix,
/{usr/,}bin/env rix,
@{bin}/{,ba,da}sh rix,
@{bin}/{,e}grep rix,
@{bin}/cut rix,
@{bin}/env rix,
@{bin}/ip rix,
@{bin}/nft rix,
@{bin}/sed rix,
/etc/iproute2/rt_realms r,
/etc/iproute2/group r,